
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@datawrapper/chart-core
Advanced tools
@datawrapper/chart-core
is a collection of useful functions and components that are required to render Datawrapper charts.
> npm i @datawrapper/chart-core
├── main.mjs
│ - Entry point for rollup to bundle `Visualization.svelte`
│ - (used by datawrapper/api)
│
├── lib
│ - Directory of source files like `Visualization.svelte`
│ - (used by datawrapper/frontend)
│
├── dist
│ - Files with global dependencies needed for chart rendering
│ - (used by datawrapper/{api,frontend})
│
└── vendor
- Source vendor files that are copied into dist when package is published
Above are the interesting files and directories to render charts. Only lib/
and dist/
get packaged and published with npm
.
When changing core functionality it is advised to link a local copy of @datawrapper/chart-core
in the datawrapper/api
or datawrapper/frontend
repositories. Follow these steps to link the package:
~/code/chart-core
❯ npm link
~/code/frontend
❯ npm link @datawrapper/chart-core
Everytime npm install
is called after that, the link is removed. Usually it is enough to run the second step again.
To publish this package run npm version {major|minor|patch}
and npm publish
. To publish you have to be part of the Datawrapper organization on npm.
To run the tests in chart-core, run
npm test
To run only a specific test file, run
npm test -- lib/shared.tests.mjs
npm test -- tests/header/headline.test.mjs
FAQs
Svelte component to render charts.
We found that @datawrapper/chart-core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 19 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.